Privacy Notice

I. Introduction

This Privacy Notice describes how information is handled when you use alexproctor.io and the services offered through it. References to "I," "me," or "my" in this Privacy Notice mean Alex Proctor LLC, a Michigan limited liability company operating as alexproctor.io. I keep two simple commitments:

• I am deliberate about the personal information I ask you to provide and the information that is handled through the operation of this website.
• I aim to make it easy for you to understand what is collected, why, how it is used and shared, and the choices you have.

II. Your Agreement to This Notice

By accessing or using this website and the services offered through it, you acknowledge that your information will be collected, used, stored, and disclosed as described in this Privacy Notice. The practices described here are deliberately narrow, and everything this website handles is described in the Information I Collect section below.

III. What This Notice Covers

Throughout this Privacy Notice I refer to the website alexproctor.io and the services offered through it collectively as the "Services." This Privacy Notice applies to information you provide to me or that is collected about you when you use the Services, which include:

• The Website. Your access to and use of the pages of alexproctor.io, including the ordering, booking, and legal pages.
• Ordering an Audit. The order form on this website and the Stripe checkout it hands off to, through which you purchase a Website Privacy Audit.
• Audit Delivery and Correspondence. Email correspondence with me, delivery of your audit video and written report through a private link, and scheduling the remediation review call that comes with your audit.

Some services used to operate this website, such as Stripe's checkout, have their own privacy notices, which govern where they apply. Capitalized terms not defined here have the meaning given in my Terms of Service.

IV. Information I Collect

I collect a small amount of information, almost all of it provided directly by you when you choose to order an audit or contact me. You are under no obligation to provide any information at any time. However, if you choose to withhold information that the Services require, I may be unable to provide you the Services or respond to your questions.

Information You Provide Directly

When you use the Services, you may provide information directly to me, including:

• Your answers to the order form's questions when you order an audit: the website URL to be audited, the regions where your website's visitors and customers are located, whether you have received a demand letter or legal complaint and any details you choose to share about it, anything you add in the notes field, and an optional delivery email address.
• Your agreement to the Terms of Service and acknowledgment of this Privacy Notice at order time.
• Whatever you choose to include when you email me, including any demand letter you choose to send for a priority audit.

If you provide a delivery email address that belongs to someone else, such as a client or colleague, you confirm that you are authorized to direct delivery to them.

The Speaking & Media booking form on this website runs entirely in your browser: submitting it opens a prefilled email in your own email application, and this website does not receive, collect, or store your answers. They reach me only if you send that email.

Payment Information

Payment is processed by Stripe, Inc. Your card details are entered on Stripe's systems and are not processed by this website. I receive confirmation of payment and standard transaction details, including the name and email address you enter at checkout. Your order form answers are attached to your transaction record in Stripe so that they stay with your order.

Information Collected Automatically

This website is served by Cloudflare, whose infrastructure processes technical data, such as IP addresses, browser type, and requested pages, to deliver pages and protect against attacks, as described in Cloudflare's privacy policy. I do not operate my own analytics on top of this, and I do not use this technical data to identify or profile visitors.

Information from Other Sources

If I write to your business about my services, I may have collected your business contact information, such as your name, role, and work email address, from public sources like your company's website or professional profiles. I use it only to contact you, and the Communications section of this Privacy Notice describes how to decline further contact.

Cookies and Local Storage

This website sets no non-essential cookies and runs no non-essential scripts. A few details worth knowing:

• Privacy Preferences Banner: This website displays a Privacy Preferences Banner powered by Captain Compliance, the consent management platform I help build. I run it as a working example of the technology, and so that consent choices are in place if tracking is ever introduced. The website runs no non-essential tracking today, so the banner has little to control beyond storing your preference:

  Cookie	Purpose
  cc_consent_*	Records that you have made a consent choice, so the banner does not reappear on every visit.
  cc_consent_cc-modal-user-location	Typically stores an approximate location so that regional consent policies can be applied. However, I have disabled location detection, because this website sets the banner to the opt-in model everywhere.
  cc_consent_preference	Stores your consent status and your per-category choices.
  cc_global_consent	Stores your recorded consent choices for the banner's settings and opt-out surfaces.
  euconsent-v2	An industry-standard (IAB TCF) consent string that records your choices in machine-readable form.

• Session storage: The order page keeps your draft answers in your browser's session storage so they survive a cancelled checkout. They stay on your device, are not transmitted until you submit the form, and clear when your browsing session ends.

Technologies I Do Not Use

It is worth stating plainly what the Services currently do not use:

• No advertising pixels, web beacons, or conversion trackers.
• No third-party analytics.
• No session replay, heat mapping, or chat widgets.
• No cross-device or cross-site tracking.
• No data purchased from or shared with data brokers.
• No collection, use, or sale of personal information to train large language models or other artificial intelligence models.

If any of this changes, this Privacy Notice and its date will change first, and any technology that requires consent will not run without it.

V. How I Use Your Information

I use the information described above to:

• Deliver the audit you ordered, including reviewing the website you submitted, preparing your video and written report, and scheduling your remediation review call.
• Tailor the audit to your answers, such as the regions you serve and any demand letter details you share.
• Communicate with you about your order, delivery, and any questions you raise.
• Follow up after your audit to ask whether you would like help with the technology to address its findings, including Captain Compliance products.
• Process your payment through Stripe and maintain the records the law requires, such as transaction records for tax purposes.
• Prevent fraud, resolve disputes, and enforce my Terms of Service.
• Improve the Services.

VI. How I Share Your Information

I share information only in the limited circumstances described below. I do not sell your personal information, do not share it for targeted advertising, and do not disclose your audit findings to anyone but you and the recipients you designate, except with your consent as described in this section.

Service Providers

Service providers used to run this business process information on my behalf. Each receives only what it needs to do its job:

Captain Compliance

Alex Proctor serves as Chief Trust & Privacy Officer at Captain Compliance, a privacy technology company. This website and its audits are operated independently of Captain Compliance.

Where an audit identifies gaps that Captain Compliance products can address, I will recommend them in the audit materials and on the review call. After delivery, I may also follow up to ask whether you would like help with the technology. Beyond the hosting described in the table above, nothing about you or your audit results is shared with Captain Compliance without your permission. I may ask for that permission, for example so their team can help with the technology.

Safety, Security, and Compliance with Law

I may disclose your information to third parties where required by law, such as in response to a subpoena or other legal process, or where I reasonably believe disclosure is necessary to enforce and protect my rights, prevent or investigate fraud, or protect the safety and security of the Services and their users.

Corporate Transactions

If this business is ever reorganized, sold, or transferred, your information may be transferred as part of that transaction, in which case the recipient may continue to process it as set forth in this Privacy Notice, except where prohibited by law.

VII. How I Store and Protect Your Information

Security

I maintain reasonable administrative, technical, and physical safeguards designed to protect your information, and the Services are hosted on infrastructure providers that maintain industry-recognized security certifications. Information handled through the Services is stored on the United States-based systems of the service providers described in the Service Providers section, subject to their security policies as well as this Privacy Notice.

However, no method of transmission over the Internet or electronic storage is infallible, and I cannot guarantee absolute security.

Data Retention

Order and transaction records are kept as long as tax and accounting law requires. Audit videos, written reports, and correspondence are deleted within 12 months of delivery or of your last interaction with me, whichever is later, unless a dispute or legal obligation requires keeping them longer. You can request earlier deletion at any time, as described in the Your Choices and Privacy Rights section.

Data Breach Notification

In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to your personal information, I will respond in accordance with applicable law. I will notify you by email at the address associated with your order without undue delay, describing to the extent known the nature of the incident, the information involved, and the steps you can take to protect yourself.

VIII. Your Choices and Privacy Rights

Individual Privacy Rights

I treat the following as baseline rights for everyone whose information I handle, whether or not a law requires it:

• Right to Know / Access: To request confirmation that I am processing your personal information and to obtain a copy of it.
• Right to Correct: To request that I correct inaccurate personal information.
• Right to Delete: To request that I delete personal information I have collected from you, subject to certain exceptions, such as records I am required to retain by law.
• Right to Portability: To receive, in a structured and commonly used format, the personal information you have provided, where technically feasible.
• Right to Opt Out: To opt out of the sale of personal information or its processing for targeted advertising or profiling. I do not process personal information for any of these purposes, but the right is yours regardless.
• Right to Non-Discrimination: I will not discriminate against you for exercising any of these rights.

A note on applicability: This small business does not meet the applicability criteria of the comprehensive U.S. state privacy laws, which generally turn on revenue or on the number of state residents whose personal information a business processes. In the spirit of privacy, I honor these rights anyway.

To exercise any of these rights, email [email protected] or use the Data Subject Request Portal, which is also linked as "Do Not Sell or Share My Personal Information" in the footer of every site page. I will respond within 30 days of receipt of a verifiable request.

First-Party Requests Only

I accept privacy requests directly from data subjects themselves, meaning the person the information is about. Submitting requests through an authorized agent is a mechanism of the comprehensive state privacy laws, and as noted above, those laws do not apply to this business. Because I honor these rights voluntarily rather than by legal obligation, I do not act on requests submitted by agents or other third parties.

Additional Information

I may deny a request, or fulfill it only in part, where the law permits or requires it, for example where records must be retained for tax, legal, or compliance purposes. If I decline a request, I will tell you why in writing, and you may ask me to reconsider by replying to that response.

Opt-Out Preference Signals

Some browsers can send opt-out preference signals such as the Global Privacy Control (GPC). Because this website does not sell or share personal information, and runs no non-essential tracking, there is no processing for these signals to stop. However, you will still see an acknowledgment of GPC signal detection in the Privacy Preferences Banner.

Communications

I do not send email newsletters. I do write to businesses that I believe would benefit from an audit, using business contact information from public sources, and this outreach may go to many businesses in the same industry at the same time. If I write to you and you would rather not hear from me, reply and say so, and I will not contact you again. Beyond that, communications from me relate to your order, your audit, or an inquiry you initiated. After an audit, I may also follow up to ask whether you would like help with the technology. If you would rather not hear about it, reply and say so, and I will stop. If you email me, I will use your address to respond and for the purposes described in this Privacy Notice.

IX. Other Important Information

Third-Party Websites and Services

The Services contain links to third-party websites and services, such as Stripe's checkout and LinkedIn. I do not control those websites, and this Privacy Notice does not apply to information collected by them. You should refer to the privacy notices applicable to those websites and services.

Age Requirements

The Services are directed to businesses and professionals and are not directed to children under the age of 18. I do not knowingly collect information from anyone under 18. If I learn that a child under 18 has provided information through the Services, I will delete it.

International Visitors

This website is operated from the United States, and information you provide is processed there. If you are ordering from the EU, the UK, or elsewhere, your information receives the same handling described in this Privacy Notice, and by using the Services you acknowledge that your information will be transferred to and processed in the United States.

Modifications to this Privacy Notice

If this Privacy Notice changes, the date above changes with it. The version posted on the Services is the version in effect. I encourage you to review this page periodically.

How To Contact Me

If you have any questions or complaints regarding this Privacy Notice or my privacy practices, please contact me by email at [email protected].